It's a Hard Lock Life: A Field Study of Smartphone (Un)Locking Behavior and Risk Perception

TLDR

Research on phone‑unlocking usability and security is abundant, yet empirical data on users’ actual unlocking behavior and risk perceptions is scarce. The study aimed to quantify the time overhead of unlocking and authentication and to assess how often users perceive such security measures as necessary, as well as to explore reasons for lock‑screen usage and coping strategies for smartphone‑related risks. An online survey of 260 participants and a one‑month field study with 52 users were conducted to observe real‑world unlocking behavior. On average, users spent 2.9 % of smartphone interaction time authenticating (up to 9 % in the worst case), 24.1 % of secure‑lock users deemed the lock unnecessary in some situations, and shoulder‑surging was considered a relevant risk in only 11 of 3,410 sampled scenarios.

Abstract

A lot of research is being conducted into improving the usability and security of phone-unlocking. There is however a severe lack of scientic data on users’ current unlocking behavior and perceptions. We performed an online survey (n = 260) and a one-month eld study ( n = 52) to gain insights into real world (un)locking behavior of smartphone users. One of the main goals was to nd out how much overhead unlocking and authenticating adds to the overall phone usage and in how many unlock interactions security (i.e. authentication) was perceived as necessary. We also investigated why users do or do not use a lock screen and how they cope with smartphone-related risks, such as shouldersurng or unwanted accesses. Among other results, we found that on average, participants spent around 2.9 % of their smartphone interaction time with authenticating (9 % in the worst case). Participants that used a secure lock screen like PIN or Android unlock patterns considered it unnecessary in 24.1 % of situations. Shoulder surng was perceived to be a relevant risk in only 11 of 3410 sampled situations.